CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- panhainan ds-javapanhainan DS-Java FileUpload.java uploadUserPic.action code injection5.3 Medium
- wix jamwix-incubator jam Jinja2 Template jam.py special elements used in a template engine4.8 Medium
- hewlett packard enterprise hpe performance cluster manager (hpcm), hpe performance cluster manager +1 moreVulnerability in Hewlett Packard Enterprise HPE Performance Cluster Manager (HPCM).This issue...8.1 High
- yoel geva android appYoel Geva - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor7.5 High
- ciliumCilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters4.0 Medium
- traefikTraefik has a possible vulnerability with the path matchers8.8 High
- opentext content managementA user enumeration and subsequent data integrity vulnerability affecting barcode functionality5.9 Medium
- amazon ion dotnetInfinite loop condition in Amazon.IonDotnet8.7 High
- opentext content managementStored XSS in Discussions functionality5.6 Medium
- dremio corporation softwareAuthenticated API Endpoint Allows Arbitrary File Deletion in Dremio Software8.4 High
- opentext arcsight enterprise security managerReference to Expired Domain Vulnerability in OpenText™ ArcSight Enterprise Security Manager2.3 Low
- opentext content serverREST API allows users without permissions to remove external collaborators5.5 Medium
- saviynt ova based connectImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')2.1 Low
- saviynt ova based connectImproper Authorization in the installer for the EOL OVA based connect component6.1 Medium
- saviynt ova based connectImproper Input Validation vulnerability in the End of Life (EOL) OVA based connect component6.1 Medium
- virtuemart, virtuemart.net virtuemart component for joomla +1 moreExtension - virtuemart.net - SQL injection in VirtueMart component 1.0.0 - 4.4.7 for Joomla3.8 Low
- formulatrix rock maker webLocal File Inclusion (LFI) leading to sensitive data exposure9.2 Critical
- gobgpGoBGP does not verify that the input length6.8 Medium
- gobgpGoBGP crashes in the flowspec parser6.8 Medium
- gobgpGoBGP panics due to a zero value for softwareVersionLen8.6 High
- gobgpGoBGP does not properly check the input length4.3 Medium
- filewaveThe FileWave Windows client before 16.0.0, in some non-default configurations, allows an...8.1 High
- sonos api.sonos.comSonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a...3.4 Low
- soffid iamIn Soffid Console 3.5.38 before 3.5.39, necessary checks were not applied to some Java objects. A...2.5 Low
- yiiot xy-3820 firmwareA vulnerability exists in the daemon process of the Yi IOT XY-3820 v6.0.24.10, which exposes a...9.8 Critical
- yiiot xy-3820 firmwareYi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmd_listen" function...9.8 Critical
- mingsoft mcmsMCMS allows arbitrary file uploads in the ueditor component9.8 Critical
- mojoportalmojoPortal <=2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller -...6.5 Medium
- code-projects online exam mastering systemcode-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in...6.1 Medium
- dogukanurker flaskblogIncorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a...9.1 Critical
- dogukanurker flaskblogIncorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts...6.4 Medium
- dogukanurker flaskblogA cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute...6.1 Medium
- fumiao opencmsopencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage...4.3 Medium
- qianxin tianqing endpoint security management systemThe quarantine - restore function in Qi-ANXIN Tianqing Endpoint Security Management System v10.0...8.8 High
- alkacon opencmsOpenCMS Cross-Site Scripting vulnerability6.5 Medium
- alkacon opencmsOpenCMS cross-site scripting (XSS) vulnerability5.4 Medium
- kuangstudy kuangsimplebbskuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted upload5.3 Medium
- phpgurukul men salon management systemPHPGurukul Men Salon Management System sales-reports-detail.php sql injection6.9 Medium
- phpgurukul men salon management systemPHPGurukul Men Salon Management System view-appointment.php sql injection6.9 Medium
- phpgurukul men salon management systemPHPGurukul Men Salon Management System forgot-password.php sql injection6.9 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-supplier.php cross site scripting4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-category.php cross site scripting4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-product.php cross site scripting4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-stock.php cross site scripting4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System changepassword.php cross site scripting4.8 Medium
- senior-walter web-based pharmacy product management systemSourceCodester Web-based Pharmacy Product Management System add-admin.php cross site scripting4.8 Medium
pocoOSS-FuzzUse-of-uninitialized-value in Poco::Net::NTLMCredentials::parseChallengeMessageNo score- struktur libheiflibheif before 1.19.6 has a NULL pointer dereference in ImageItem_Grid::get_decoder in image...2.9 Low
- struktur libheiflibheif before 1.19.6 has a NULL pointer dereference in ImageItem_iden in image-items/iden.cc.2.9 Low
- librawIn LibRaw before 0.21.4, tag 0x412 processing in phase_one_correct in decoders/load_mfbacks.cpp...2.9 Low
- Show moreLoading…